@s7ephen basically with a syntax like that and pointers/offset xref logic, even RoP payloads would be easily identified, with a gadgets db. SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique